�K�]c������(���*D��{���ц��"�o���˘"�������|��#��R8�z1�+��7l����}]!?+Hz�,�mg�_>�uqБ�}��QX.G����=_G� ��m�u�H.����0U2��^]9����Z`���p��� ��L��A ~6�W�d�ʨgI'۫�Obgl�\_�CޚR^� ���d�2%�+w�P�)���;c�s`���6 �������hcއH_���� 5(U!�}�8����:�HM�����h�()We�;Nυ:�cռ2^J����7$�S`���_����KV���Gr��?���'��ӆ���"L(7���"��e���U�D��%��FƖ����)��u�ɜ��Z�W�c��W�G:4Jn��/���� b�,�B��|<W��=��B'���-�I�g���0�T�C),Hy�/���_��->���AE��hwdD�ڞ����9�'�'� M�����n` �F|O�%p� b_�1��9'$�s�U61�͵����NP������a�����G��HgQ������ /�����q�D��%u�&yx�M�m#�+��fE�x`�`btT��>��Ѿ|��8� dY�Y"���r�M�����GT4������������σtS��3ׁ��R�x�\���s��6�> I���?��P��/m��T`�j"WB���N�� ��dH��}d|���2���.z}b,�gR2z`�Pr�\��ޝ[��W��S��+�k��̵|���SMF�a@KJ֢g.0I���������c������.5����$F�?q���b�+ڟ,@2y&��e��)o)��Z�b M#��sOo�_81`�k�۲z����:���A ~ B�}�Y�i��ű-�g����y!�(��I_6T����X@ӯ<��6c����m��I��r��g[�y&Ą�8wm�����*��:¦�lV����:y�UQ� +G��i0C/�I�W�zsR��Ż��c�-�mx ����_Ӧ7�r���[�|`�������T�oR��ړ�B�Nn��P�����vʗ�pB=�Ԙ�:Ѻ�Pu98$�X ��iL��_�Kw��4��#�3�� @�����b������âB$(@��f4 �����/J!ʒ�ބ[���k�L��p��&�曪1��V_��i����oP��aLx@�-�!;�����ϿQ9}�_kb��� �# HorqN ��.�8�;mg1*��[�C̼� �z�w�=�O�c�g�������Th-���H�G�c��#�٢���0���}0�c�&O���<~bж1�����G|����\��|��(���1��0~�Y����-� 2�s�,���<��e����a_%�7a=L���*^����y�ZN8=|�����k�}D&�E�n|�)� .�3�U�����T �7�hHv�v�T�`��H�\��c&����"�9��?�o�&;��7o��/d:�L�ca.�>[i�Ta���H �/���R04h꧁vC��,B("U)��m���=��䬏l���K}@�9�HD �x������j�rΈ�7��0]�W��!��H��������z�ٻ�7��I��Ha�! �f�dq���zE}��5����U /q���D�j�PA]�jyѓm�2�R�Q �8@�|�&�&�Ȍ�C�e_B(��9YB����Ô��9��%^Z�����&̺x(�'8g� �P=�Jrf.�7.�hH]��W���s����@�J���cKf5H2oiS��K����i5���$`�mt�o絴���քL�����'-І���� \'�aݎ���@��7C��VX���շ���lFw}�n�:��"�վ`|#� ����������BQk�7���T;��젘�t[��������a��B�#�5��6#�[$d��i����LzT��ޛ�����b�: E@s������ܑqI�-Z�ԋe6���g��e�?�?op������<K1�q�i�3�N�f�7t��0_P���=뻷��w�d%��s+c�^��y�EP����7�E�ď4��, d �ߤ[h�j{e��cXB��,Pݕ������vn��Օ��B2���u�#�y�ߋ$����ǐ���}A���g�K��mje�c�}�Ѓ���|����b�> �9�����c�S|��s�E��P�IY�e���D�Zsvl�cZdz_3����娨KO�3�$Gd� � �,������eӮ��ik��K���8�y����º���^�Kϯ����t��L��""J�[������[93�ς����eaٳu�'�E먠!X}���b�7O����iF�x�W;���~C���|_��;�҇b��3p�`np��ʀ��$HZ�?��'X������I�ws������hE�;�;_�obx����Odn4���9���-&K��s�-��MTt�p�6-��â[�S���r5�����7�]��g��F��rϞ0V����4�F��$��QTB;��^L�_w�z1�l查EA4� �46��hID $�����L�άT}�-Jf�d@�ۗ�9�����Q�6��l����,i�7��`���W�u��!��1�6ℸh\��֏�<��7m� iB�%�t.��FȆi��/���������Ԭb���+\�ct�%����W3D���!��z[FE�>!�a�GVť4� c���e�Mރvm 'a��:�D�B����)|��ߪ�EJu�F�1+���t�24v7,e�Ϟ��5E�}���w?p��Fu��������W*5�t���������u-1r>tK�Eȭc��Ub��A�v��#����ֱ��n����2����A�Fł�#߀k�9��k���V��}��0224W)��3����Ȳ���KF�7w����O�� ۻNd2ٵc�0��+�����g��� �m�߂n��i�+E(@��t��?e�Ҡ�0���Z���<d͗��P�����0U��__c�mپ�;�.�j�Zy�x+-'�ߛ {�
Static task
static1
Behavioral task
behavioral1
Sample
5d4155ebce3f007284dd45b7cbb81efe_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d4155ebce3f007284dd45b7cbb81efe_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d4155ebce3f007284dd45b7cbb81efe_JaffaCakes118
-
Size
6.7MB
-
MD5
5d4155ebce3f007284dd45b7cbb81efe
-
SHA1
a9a0a9c61f426c15378ea027dd98feb29ee12202
-
SHA256
e39a94c2e6eeffa82d2faf856a190766cb4b22cfb7cbe5789fe568be542996f2
-
SHA512
938484959549ebcdb7f3c3ba8b013c3b6bc01c20d2fc3c45a4c1c8257e53451e32d017eefb424d22e2efb26734fa14ddb2067a2ff7a26cd6133680c076c7fe4b
-
SSDEEP
98304:QpXBZGthC+joDbEGMK/JrfUnGln/StG+jxNThQSsGZh5D9lrOkwgkXC6JFaMY1IY:QpXBIShrfUun64exN1sYP5ok14JdAII
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d4155ebce3f007284dd45b7cbb81efe_JaffaCakes118
Files
-
5d4155ebce3f007284dd45b7cbb81efe_JaffaCakes118.exe windows:6 windows x64 arch:x64
e25903b4ab0ded1316f47397cfc4dfa0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
mouse_event
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegDeleteKeyA
shell32
ShellExecuteA
msvcp140
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
winmm
timeEndPeriod
imm32
ImmSetCompositionWindow
urlmon
URLDownloadToFileA
wininet
HttpOpenRequestA
d3d9
Direct3DCreate9
iphlpapi
GetAdaptersInfo
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
ntdll
NtQueryInformationProcess
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
_isatty
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 476B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ